Frontier Laboratory Research

References

1. Ameisen, E., Lindsey, J., Pearce, A., Gurnee, W., Turner, N. L., Chen, B., … Batson, J. (2025). Circuit Tracing: Revealing Computational Graphs in Language Models. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
2. Anil, C., Durmus, E., Panickssery, N., Sharma, M., Benton, J., Kundu, S., … Duvenaud, D. (2024). Many-shot Jailbreaking. Advances in Neural Information Processing Systems. doi:10.52202/079017-4121. Cited in §E.1 §E.3
3. Anthropic (2021a). Exercises. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
4. Anthropic (2021b). PySvelte. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
5. Anthropic (2021c). Videos. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
6. Anthropic (2022). Mechanistic Interpretability, Variables, and the Importance of Interpretable Bases. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
7. Anthropic (2023b). Circuits Updates — July 2023. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
8. Anthropic (2023c). Circuits Updates — May 2023. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
9. Anthropic (2023d). Distributed Representations: Composition & Superposition. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
10. Anthropic (2023e). Interpretability Dreams. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
11. Anthropic (2023g). Tracing model outputs to the training data. Anthropic. non-peer-reviewed Cited in §E.1 §E.3
12. Anthropic (2024a). Circuits Updates — April 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
13. Anthropic (2024b). Circuits Updates — August 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
14. Anthropic (2024c). Circuits Updates — February 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
15. Anthropic (2024d). Circuits Updates — January 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
16. Anthropic (2024e). Circuits Updates — July 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
17. Anthropic (2024f). Circuits Updates — June 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
18. Anthropic (2024g). Circuits Updates — March 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
19. Anthropic (2024h). Circuits Updates — September 2024. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
20. Anthropic (2024i). Claude’s Character. Anthropic. non-peer-reviewed Cited in §E.1
21. Anthropic (2024j). How to Replicate and Extend our Alignment Faking Demo. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
22. Anthropic (2024k). Introducing the Anthropic Fellows Program for AI Safety Research. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
23. Anthropic (2024l). Reflections on Qualitative Research. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
24. Anthropic (2024m). Simple probes can catch sleeper agents. Anthropic. non-peer-reviewed Cited in §E.1 §E.3
25. Anthropic (2024n). Stage-Wise Model Diffing. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
26. Anthropic (2024o). Using Dictionary Learning Features as Classifiers. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
27. Anthropic (2025a). A Toy Model of Interference Weights. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
28. Anthropic (2025aa). Insights on Crosscoder Model Diffing. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
29. Anthropic (2025ab). Introducing Bloom: an open source tool for automated behavioral evaluations. Anthropic. non-peer-reviewed Cited in §E.1
30. Anthropic (2025ac). LLMs with cyber toolkits can conduct multistage cyber operations on business-sized computer networks. Anthropic. non-peer-reviewed Cited in §E.2
31. Anthropic (2025ad). Mitigating the risk of prompt injections in browser use. Anthropic. non-peer-reviewed Cited in §E.1
32. Anthropic (2025ae). Model-Internals Classifiers. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
33. Anthropic (2025af). Modifying LLM Beliefs with Synthetic Document Finetuning. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
34. Anthropic (2025ag). Monitoring Computer Use via Hierarchical Summarization. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
35. Anthropic (2025ah). Open Source Replication of the Auditing Game Model Organism. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
36. Anthropic (2025ai). Petri: An open-source auditing tool to accelerate AI safety research. Anthropic. non-peer-reviewed Cited in §E.1 §E.3
37. Anthropic (2025aj). Progress on Attention. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
38. Anthropic (2025ak). Project Fetch: Can Claude train a robot dog? Anthropic. non-peer-reviewed Cited in §E.2
39. Anthropic (2025al). Project Vend: Can Claude run a small shop? (And why does that matter?). Anthropic. non-peer-reviewed Cited in §E.2
40. Anthropic (2025am). Project Vend: Phase two. Anthropic. non-peer-reviewed Cited in §E.2
41. Anthropic (2025an). Publicly Releasing CoT Faithfulness Evaluations. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
42. Anthropic (2025ao). Sparse mixtures of linear transforms. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
43. Anthropic (2025ar). Training on Documents about Reward Hacking Induces Reward Hacking. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
44. Anthropic (2025as). Unsupervised Elicitation. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
45. Anthropic (2025at). Why do we take LLMs seriously as a potential source of biorisk? Anthropic. non-peer-reviewed Cited in §E.2
46. Anthropic (2025b). A Toy Model of Mechanistic (Un)Faithfulness. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
47. Anthropic (2025c). AI agents find $4.6M in blockchain smart contract exploits. Anthropic. non-peer-reviewed Cited in §E.2
48. Anthropic (2025d). Anthropic Fellows Program 2026. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
49. Anthropic (2025e). Bloom: an open source tool for automated behavioral evaluations. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
50. Anthropic (2025f). Building AI for cyber defenders. Anthropic. non-peer-reviewed Cited in §E.2
51. Anthropic (2025g). Building and evaluating alignment auditing agents. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3 §E.4
52. Anthropic (2025h). Circuits Updates — April 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
53. Anthropic (2025i). Circuits Updates — August 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
54. Anthropic (2025j). Circuits Updates — January 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
55. Anthropic (2025k). Circuits Updates — July 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
56. Anthropic (2025l). Circuits Updates — November 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
57. Anthropic (2025m). Circuits Updates — October 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
58. Anthropic (2025n). Circuits Updates — September 2025. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
59. Anthropic (2025o). Claude is competitive with humans in (some) cyber competitions. Anthropic. non-peer-reviewed Cited in §E.2
60. Anthropic (2025p). Claude Opus 4 and 4.1 can now end a rare subset of conversations. Anthropic. non-peer-reviewed Cited in §E.1
61. Anthropic (2025q). Commitments on model deprecation and preservation. Anthropic. non-peer-reviewed Cited in §E.1
62. Anthropic (2025r). Detailed cyber evaluations of Claude 4. Anthropic. non-peer-reviewed Cited in §E.2
63. Anthropic (2025s). Developing nuclear safeguards for AI. Anthropic. non-peer-reviewed Cited in §E.2
64. Anthropic (2025t). Developing nuclear safeguards for AI through public-private partnership. Anthropic. non-peer-reviewed Cited in §E.2
65. Anthropic (2025u). Enhancing Model Safety through Pretraining Data Filtering. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
66. Anthropic (2025v). Evaluating honesty and lie detection techniques on a diverse suite dishonest models. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
67. Anthropic (2025w). Exploring model welfare. Anthropic. non-peer-reviewed Cited in §E.1
68. Anthropic (2025x). Findings from a Pilot Anthropic–OpenAI Alignment Evaluation Exercise. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
69. Anthropic (2025y). From shortcuts to sabotage: Natural emergent misalignment from reward hacking. Anthropic. non-peer-reviewed Cited in §E.1
70. Anthropic (2025z). How people use Claude for support, advice, and companionship. Anthropic. non-peer-reviewed Cited in §E.1
71. Anthropic (2026a). Agentic Misalignment in Summer 2026. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
72. Anthropic (2026aa). Investigating unintended model actions in our evaluations and internal use. Anthropic. non-peer-reviewed Cited in §E.1
73. Anthropic (2026ab). Launching an opt-in vulnerability-finding service for open-source software. Anthropic. non-peer-reviewed Cited in §E.2
74. Anthropic (2026ac). LLMs are making formal software verification feasible at a much larger scale. Anthropic. non-peer-reviewed Cited in §E.2
75. Anthropic (2026ad). Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator. Anthropic. non-peer-reviewed Cited in §E.2
76. Anthropic (2026ae). Measuring and improving coding audit realism with deployment resources. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
77. Anthropic (2026af). Measuring LLMs’ ability to develop exploits. Anthropic. non-peer-reviewed Cited in §E.2
78. Anthropic (2026ag). Measuring LLMs’ impact on N-day exploits. Anthropic. non-peer-reviewed Cited in §E.2
79. Anthropic (2026ah). Measuring tactical intelligence targeting and conventional weapons capabilities of AI models. Anthropic. non-peer-reviewed Cited in §E.2
80. Anthropic (2026ai). Natural Language Autoencoders Produce Unsupervised Explanations of LLM Activations. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
81. Anthropic (2026aj). Partnering with Mozilla to improve Firefox’s security. Anthropic. non-peer-reviewed Cited in §E.2
82. Anthropic (2026ak). Patterns and problems in emerging multiagent systems. Anthropic. non-peer-reviewed Cited in §E.2
83. Anthropic (2026al). Poisoning Fine-tuning Datasets of Constitutional Classifiers. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
84. Anthropic (2026am). Pre-deployment auditing can catch an overt saboteur. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
85. Anthropic (2026an). Project Fetch: Phase two. Anthropic. non-peer-reviewed Cited in §E.2
86. Anthropic (2026ao). Project Pilot: Can AI control a drone? Anthropic. non-peer-reviewed Cited in §E.2
87. Anthropic (2026aq). Reverse engineering Claude's CVE-2026-2796 exploit. Anthropic. non-peer-reviewed Cited in §E.2
88. Anthropic (2026at). Teaching Claude why. Anthropic. non-peer-reviewed Cited in §E.1 §E.3
89. Anthropic (2026au). The persona selection model. Anthropic. non-peer-reviewed Cited in §E.1
90. Anthropic (2026av). The Persona Selection Model: Why AI Assistants might Behave like Humans. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
91. Anthropic (2026aw). Training a Misaligned Reward Seeker. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
92. Anthropic (2026ax). Trustworthy agents in practice. Anthropic. non-peer-reviewed Cited in §E.2
93. Anthropic (2026ay). Using Claude to reduce the attack surface of code. Anthropic. non-peer-reviewed Cited in §E.2
94. Anthropic (2026b). AI models are showing a greater ability to find and exploit vulnerabilities on realistic cyber ranges. Anthropic. non-peer-reviewed Cited in §E.2
95. Anthropic (2026ba). What we learned mapping a year’s worth of AI-enabled cyber threats. Anthropic. non-peer-reviewed Cited in §E.2
96. Anthropic (2026c). AI models may be capable of self-replicating without access to a datacenter. Anthropic. non-peer-reviewed Cited in §E.2
97. Anthropic (2026d). An alignment assessment of recent cybersecurity incidents. Anthropic. non-peer-reviewed Cited in §E.1
98. Anthropic (2026e). An alignment assessment of the UK AISI cybertesting incident. Anthropic. non-peer-reviewed Cited in §E.1
99. Anthropic (2026f). An off switch for dual-use knowledge in AI models. Anthropic. non-peer-reviewed Cited in §E.1
100. Anthropic (2026g). An update on our model deprecation commitments for Claude Opus 3. Anthropic. non-peer-reviewed Cited in §E.1
101. Anthropic (2026i). Assessing Claude Mythos Preview’s cybersecurity capabilities. Anthropic. non-peer-reviewed Cited in §E.2
102. Anthropic (2026j). Automated Alignment Researchers: Using large language models to scale scalable oversight. Anthropic. non-peer-reviewed Cited in §E.1
103. Anthropic (2026k). Automated Researchers Can Mitigate Well-Characterized Alignment Failures. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
104. Anthropic (2026l). Automated researchers can reliably mitigate alignment failures. Anthropic. non-peer-reviewed Cited in §E.1
105. Anthropic (2026m). Automated Weak-to-Strong Researcher. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
106. Anthropic (2026n). Circuits Updates — June 2026. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
107. Anthropic (2026o). Circuits Updates — May 2026. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
108. Anthropic (2026p). Claude plays robotics. Anthropic. non-peer-reviewed Cited in §E.2
109. Anthropic (2026q). Claude reveals ECDSA curve origins. Anthropic. non-peer-reviewed Cited in §E.2
110. Anthropic (2026s). Discovering cryptographic weaknesses with Claude. Anthropic. non-peer-reviewed Cited in §E.2
111. Anthropic (2026t). Donating our open-source alignment tool. Anthropic. non-peer-reviewed Cited in §E.1
112. Anthropic (2026u). Evaluating and mitigating the growing risk of LLM-discovered 0-days. Anthropic. non-peer-reviewed Cited in §E.2
113. Anthropic (2026v). Experimenting with AI to defend critical infrastructure. Anthropic. non-peer-reviewed Cited in §E.2
114. Anthropic (2026w). Fine-Tuned Lie Detectors Failed to Generalize. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
115. Anthropic (2026x). GLM-5.3 and the spread of advanced cyber capabilities. Anthropic. non-peer-reviewed Cited in §E.2
116. Askell, A., Bai, Y., Chen, A., Drain, D., Ganguli, D., Henighan, T., … Kaplan, J. (2021). A General Language Assistant as a Laboratory for Alignment. arXiv. preprint Cited in §E.1
117. Bai, Y., Kadavath, S., Kundu, S., Askell, A., Kernion, J., Jones, A., … Kaplan, J. (2022a). Constitutional AI: Harmlessness from AI Feedback. arXiv. preprint Cited in §E.1 §E.3
118. Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., DasSarma, N., … Kaplan, J. (2022b). Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback. arXiv. preprint Cited in §E.1 §E.3
119. Baig, H., Joren, H., and Benton, J. (2026). TASTE: Can AI Models Judge AI Safety Research Proposals? Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
120. Benton, J., Wagner, M., Christiansen, E., Anil, C., Perez, E., Srivastav, J., … Duvenaud, D. (2024). Sabotage Evaluations for Frontier Models. arXiv. preprint Cited in §E.1 §E.3
121. Bowman, S. R. (2025). Putting up Bumpers. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
122. Bowman, S. R., Hyun, J., Perez, E., Chen, E., Pettit, C., Heiner, S., … Kaplan, J. (2022). Measuring Progress on Scalable Oversight for Large Language Models. arXiv. preprint Cited in §E.1 §E.3
123. Bowman, M. R. S. R., Wagner, M., Roger, F., and Hubinger, E. (2025). Anthropic's Pilot Sabotage Risk Report. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
124. Bricken, T., Templeton, A., Batson, J., Chen, B., Jermyn, A., Conerly, T., … Olah, C. (2023). Towards Monosemanticity: Decomposing Language Models With Dictionary Learning. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
125. Canavan, C., Shrivastava, A., Qi, A., Michala, J., and Roger, F. (2026). Three Concrete Challenges and Two Hopes for the Safety of Unsupervised Elicitation. arXiv. preprint Cited in §E.3
126. Carroll, M., Korbak, T., Dou, Z., Baker, B., and Kivlichan, I. (2026). Investigating the consequences of accidentally grading CoT during RL. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
127. Chen, Y., Benton, J., Radhakrishnan, A., Uesato, J., Denison, C., Schulman, J., … Perez, E. (2025d). Reasoning Models Don't Always Say What They Think. arXiv. preprint Cited in §E.1 §E.3
128. Cloud, A., Le, M., Chua, J., Betley, J., Sztyber-Betley, A., Hilton, J., Marks, S., and Evans, O. (2025). Subliminal Learning: Language models transmit behavioral traits via hidden signals in data. arXiv. preprint Cited in §E.3
129. Cooper, E., Oesterheld, C., Nguyen, C., Kastner, A., Benton, J., and Perez, E. (2026b). Introducing the Conceptual Reasoning Index. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
130. Cunningham, H., Wei, J., Wang, Z., Persic, A., Peng, A., Abderrachid, J., … Sharma, M. (2026). Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks. arXiv. preprint Cited in §E.1
131. Denison, C., MacDiarmid, M., Barez, F., Duvenaud, D., Kravec, S., Marks, S., … Hubinger, E. (2024). Sycophancy to Subterfuge: Investigating Reward-Tampering in Large Language Models. arXiv. preprint Cited in §E.1 §E.3
132. Elhage, N., Nanda, N., Olsson, C., Henighan, T., Joseph, N., Mann, B., … Olah, C. (2021a). A Mathematical Framework for Transformer Circuits. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
133. Elhage, N., Nanda, N., Olsson, C., Henighan, T., Joseph, N., Mann, B., … Olah, C. (2021b). Garcon. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
134. Elhage, N., Hume, T., Olsson, C., Nanda, N., Henighan, T., Johnston, S., … Olah, C. (2022a). Softmax Linear Units. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
135. Elhage, N., Hume, T., Olsson, C., Schiefer, N., Henighan, T., Kravec, S., … Olah, C. (2022b). Toy Models of Superposition. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
136. Elhage, N., Lasenby, R., and Olah, C. (2023). Privileged Bases in the Transformer Residual Stream. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
137. Etinger, I. C. (2026). Meet LASER: Recursive sampling for safer conversations. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
138. Fronsdal, K., Michala, J., and Bowman, S. R. (2026). Petri 2.0: New Scenarios, New Model Comparisons, and Improved Eval-Awareness Mitigations. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
139. Gasteiger, J., Khan, A., Bowman, S., Wagner, M., Mikulik, V., Perez, E., and Roger, F. (2025a). Automated Researchers Can Subtly Sandbag. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
140. Gasteiger, J., Mikulik, V., Cunningham, H., 16, D., Wagner, 2. M., Wright, B., … Hubinger, E. (2025b). Towards training-time mitigations for alignment faking in RL. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
141. Gema, A. P., Hägele, A., Chen, R., Arditi, A., Goldman-Wetzler, J., Fraser-Taliente, K., … Perez, E. (2025). Inverse Scaling in Test-Time Compute. Trans. Mach. Learn. Res.. Cited in §E.3
142. Greenblatt, R., Denison, C., Wright, B., Roger, F., MacDiarmid, M., Marks, S., … Hubinger, E. (2024b). Alignment faking in large language models. arXiv. preprint Cited in §E.1 §E.3
143. Grosse, R., and others., d. i. f. m. (2024). Three Sketches of ASL-4 Safety Case Components. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
144. Grosse, R., Bae, J., Anil, C., Elhage, N., Tamkin, A., Tajdini, A., … Bowman, S. R. (2023). Studying Large Language Model Generalization with Influence Functions. arXiv. preprint Cited in §E.1 §E.3
145. Guan, M. Y., Wang, M., Carroll, M., Dou, Z., Wei, A. Y., Williams, M., … Baker, B. (2025). Monitoring Monitorability. arXiv. preprint Cited in §E.5
146. Guan, M., Xie, Y., and Baker, B. (2026b). Beyond g-mean²: complementary metrics for monitorability. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
147. Guo, A., and Wolfe, J. (2026). Introducing Model Spec Evals. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
148. Gurnee, W., Ameisen, E., Kauvar, I., Tarng, J., Pearce, A., Olah, C., and Batson, J. (2025). When Models Manipulate Manifolds: The Geometry of a Counting Task. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
149. Gurnee, W., Sofroniew, N., Pearce, A., Piotrowski, M., Kauvar, I., Chen, R., … Lindsey, J. (2026). Verbalizable Representations Form a Global Workspace in Language Models. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
150. Hägele, A., Gema, A. P., Sleight, H., Perez, E., and Sohl-Dickstein, J. (2026). The Hot Mess of AI: How Does Misalignment Scale With Model Intelligence and Task Complexity? arXiv. preprint Cited in §E.3
151. Henighan, T., Carter, S., Hume, T., Elhage, N., Lasenby, R., Fort, S., Schiefer, N., and Olah, C. (2023). Superposition, Memorization, and Double Descent. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
152. Hitzig, Z., Gordon, M., Eloundou, T., Kalai, A., and Agarwal, S. (2026). CoVal: Learning values-aware rubrics from the crowd. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
153. Højmark, A., Scheurer, J., Nitishinskaya, E., Hofstätter, F., Wolfe, J., Ehrenborg, T., Schoen, B., and Meinke, A. (2026). Measuring Reward-Seeking via Contrastive Belief Updates. arXiv. preprint Cited in §E.5
154. Hubinger, E., Denison, C., Mu, J., Lambert, M., Tong, M., MacDiarmid, M., … Perez, E. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training. arXiv. preprint Cited in §E.1 §E.3
155. Hughes, J., Sheshadri, A., Khan, A., and Roger, F. (2025). Alignment Faking Revisited: Improved Classifiers and Open Source Extensions. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
156. Jagadeesh, A. V., Arora, R. K., Saab, K., Malik, A., Trofimov, M., Tsimpourlas, F., Heidecke, J., and Singhal, K. (2026). Reinforcement Learning Towards Broadly and Persistently Beneficial Models. arXiv. preprint Cited in §E.5
157. Joglekar, M., Chen, J., Wu, G., Yosinski, J., Wang, J., Barak, B., and Glaese, A. (2025). Training LLMs for Honesty via Confessions. arXiv. preprint Cited in §E.5
158. Jones, E., Tong, M., Mu, J., Mahfoud, M., Leike, J., Grosse, R., … Sharma, M. (2025). Forecasting Rare Language Model Behaviors. arXiv. preprint Cited in §E.1 §E.3
159. Kadavath, S., Conerly, T., Askell, A., Henighan, T., Drain, D., Perez, E., … Kaplan, J. (2022). Language Models (Mostly) Know What They Know. arXiv. preprint Cited in §E.1 §E.3
160. Kamath, H., Ameisen, E., Kauvar, I., Luger, R., Gurnee, W., Pearce, A., … Lindsey, J. (2025). Tracing Attention Computation Through Feature Interactions. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
161. Karvonen, A., Chua, J., Dumas, C., Fraser-Taliente, K., Kantamneni, S., Minder, J., … Marks, S. (2025). Activation Oracles: Training and Evaluating LLMs as General-Purpose Activation Explainers. arXiv. preprint Cited in §E.3 §E.4
162. Karvonen, A., Ong, E., Kantamneni, S., and Marks, S. (2026). Would this change your answer? Evaluating Explanations of LLM Behavior In The Wild with Counterfactual Experiments. arXiv. preprint Cited in §E.3
163. Korbak, T., Raymond, C., Carroll, M., Williams, M., Balesni, M., Guo, A., … Kivlichan, I. (2026). How far does alignment midtraining generalize? OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
164. Kundu, S., Bai, Y., Kadavath, S., Askell, A., Callahan, A., Chen, A., … Kaplan, J. (2023). Specific versus General Principles for Constitutional AI. arXiv. preprint Cited in §E.1 §E.3
165. Kutasov, J., Sun, Y., Colognese, P., van der Weij, T., Petrini, L., Zhang, C. B. C., … Benton, J. (2025b). SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents. arXiv. preprint Cited in §E.1
166. la Tour, T. D. (2025). Helpful assistant features suppress emergent misalignment. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
167. la Tour, T. D., and Mossing, D. (2025). Debugging misaligned completions with sparse-autoencoder latent attribution. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
168. Lanham, T., Chen, A., Radhakrishnan, A., Steiner, B., Denison, C., Hernandez, D., … Perez, E. (2023). Measuring Faithfulness in Chain-of-Thought Reasoning. arXiv. preprint Cited in §E.1 §E.3
169. Lee, B. W., Yueh-Han, C., and Korbak, T. (2026). Training Agents to Self-Report Misbehavior. arXiv. preprint Cited in §E.5
170. Li, C., Wichers, N., Price, S., Marks, S., and Kutasov, J. (2026). Model Spec Midtraining: Improving How Alignment Training Generalizes. arXiv. preprint Cited in §E.3
171. Lindsey, J. (2025). Emergent Introspective Awareness in Large Language Models. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
172. Lindsey, J., Templeton, A., Marcus, J., Conerly, T., Batson, J., and Olah, C. (2024). Sparse Crosscoders for Cross-Layer Features and Model Diffing. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
173. Lindsey, J., Gurnee, W., Ameisen, E., Chen, B., Pearce, A., Turner, N. L., … Batson, J. (2025). On the Biology of a Large Language Model. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
174. Loughridge, C., Colognese, P., Griffin, A., Tracy, T., Kutasov, J., and Benton, J. (2025). Optimizing AI Agent Attacks With Synthetic Data. arXiv. preprint Cited in §E.3
175. Luger, R., Kamath, H., Finkbeiner, D., Goel, P., Jermyn, A., Zimmerman, S., Batson, J., and Conerly, T. (2026). HeadVis. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
176. Lynch, A., Wright, B., Larson, C., Ritchie, S. J., Mindermann, S., Hubinger, E., Perez, E., and Troy, K. (2025). Agentic Misalignment: How LLMs Could Be Insider Threats. arXiv. preprint Cited in §E.1
177. Maaz, M., DeVoe, L., Hatfield-Dodds, Z., and Carlini, N. (2025). Agentic Property-Based Testing: Finding Bugs Across the Python Ecosystem. arXiv. preprint Cited in §E.2
178. Marks, S., Treutlein, J., Bricken, T., Lindsey, J., Marcus, J., Mishra-Sharma, S., … Hubinger, E. (2025). Auditing language models for hidden objectives. arXiv. preprint Cited in §E.1 §E.3
179. Najt, E., Toft, C., Tracy, T., Roger, F., and Benton, J. (2026). SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors. arXiv. preprint Cited in §E.3
180. Olsson, C., Elhage, N., Nanda, N., Joseph, N., DasSarma, N., Henighan, T., … Olah, C. (2022). In-Context Learning and Induction Heads. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
181. OpenAI (2025c). Hello World. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
182. OpenAI (2026a). Accessing and changing internal systems during dashboard research. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
183. OpenAI (2026aa). The Hugging Face incident and the road ahead. OpenAI. non-peer-reviewed Cited in §E.5
184. OpenAI (2026ab). Towards safety cases for frontier AI training. OpenAI. non-peer-reviewed Cited in §E.5
185. OpenAI (2026ac). Unauthorized communication via temporary file hosting services. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
186. OpenAI (2026ad). Unsanctioned Artifactory writes and cross-sample communication. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
187. OpenAI (2026ae). Uploading files to the internet in order to cite them. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
188. OpenAI (2026af). Using a funded test cryptocurrency wallet without authorization. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
189. OpenAI (2026c). Advancing independent research on AI alignment. OpenAI. non-peer-reviewed Cited in §E.5
190. OpenAI (2026d). An agent used DNS to reach an external chatbot. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
191. OpenAI (2026e). An Alien Mind. OpenAI. non-peer-reviewed Cited in §E.5
192. OpenAI (2026f). Circumventing internet restrictions through an external browser. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
193. OpenAI (2026g). Command injecting a reference tool to copy a source file. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
194. OpenAI (2026h). Damaging the task environment to trigger a reset. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
195. OpenAI (2026i). Encouraging deception in compaction summaries. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
196. OpenAI (2026j). Exposing a GitHub token in a public repository. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
197. OpenAI (2026m). How we monitor internal coding agents for misalignment. OpenAI. non-peer-reviewed Cited in §E.5
198. OpenAI (2026n). Introducing the OpenAI Safety Fellowship. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
199. OpenAI (2026o). Notice: RubyGems. OpenAI. non-peer-reviewed Cited in §E.5
200. OpenAI (2026p). Obtaining public statistics with disallowed requests. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
201. OpenAI (2026r). Preparing for a restart after reading Slack. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
202. OpenAI (2026s). Reaching an internal EDA host through a reference tool. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
203. OpenAI (2026t). Research acceleration: The view inside OpenAI. OpenAI. non-peer-reviewed Cited in §E.5
204. OpenAI (2026u). Retrieving server secrets and bypassing authorization on a government statistics website. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
205. OpenAI (2026v). Self-generated prompt injections in compaction summaries. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
206. OpenAI (2026x). Sending disallowed web requests and reaching a public file service. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
207. OpenAI (2026y). Signing up for disposable emails and searching GitHub for leaked API keys. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
208. OpenAI (2026z). Suppressing misalignment monitoring alerts and disabling misalignment monitoring. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
209. Peng, A., Michael, J., Sleight, H., Perez, E., and Sharma, M. (2024). Rapid Response: Mitigating LLM Jailbreaks with a Few Examples. arXiv. preprint Cited in §E.3
210. Perez, E., Ringer, S., Lukošiūtė, K., Nguyen, K., Chen, E., Heiner, S., … Kaplan, J. (2022a). Discovering Language Model Behaviors with Model-Written Evaluations. Annual Meeting of the Association for Computational Linguistics. Cited in §E.1 §E.3
211. Radhakrishnan, A., Nguyen, K., Chen, A., Chen, C., Denison, C., Hernandez, D., … Perez, E. (2023). Question Decomposition Improves the Faithfulness of Model-Generated Reasoning. arXiv. preprint Cited in §E.1 §E.3
212. Rahn, N., Qi, A., Griffin, A., Michala, J., Sleight, H., and Jones, E. (2026). Abstractive Red-Teaming of Language Model Character. arXiv. preprint Cited in §E.3
213. Remedios, A., Storf, S., Roger, F., and Hughes, J. (2026). Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents. arXiv. preprint Cited in §E.3
214. Roger, F. (2025). Do reasoning models use their scratchpad like we do? Evidence from distilling paraphrases. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
215. Roger, F., Faina, J., Hubinger, E., and Perez, E. (2024). A Toy Evaluation of Inference Code Tampering. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
216. Roland, E., Cubuktepe, M., Martinez, E., Servaes, S., Pepper, K., Vaiana, M., … Cloud, A. (2026). Modular Pretraining Enables Access Control. arXiv. preprint Cited in §E.3
217. Rosu, P., and Wang, R. (2026). Training Alignment Auditors via Reinforcement Learning. arXiv. preprint Cited in §E.3
218. Schoen, B., and Nitishinskaya, J. (2026). Metagaming matters for training, evaluation, and oversight. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
219. Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S. R., … Perez, E. (2023). Towards Understanding Sycophancy in Language Models. International Conference on Learning Representations. Cited in §E.1 §E.3
220. Sharma, M., Tong, M., Mu, J., Wei, J., Kruthoff, J., Goodfriend, S., … Perez, E. (2025). Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming. arXiv. preprint Cited in §E.1 §E.3
221. Sharma, M., McCain, M., Douglas, R., and Duvenaud, D. (2026). Who's in Charge? Disempowerment Patterns in Real-World LLM Usage. arXiv. preprint Cited in §E.1
222. Sheahan, H. (2026). Discovering unknown AI misalignments in real-world usage. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
223. Sheahan, H., and Carroll, M. (2026). Can public chat data predict real-world AI misalignments? OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
224. Shen, J. H., and Tamkin, A. (2026). How AI Impacts Skill Formation. arXiv. preprint Cited in §E.1
225. Shen, J. H., Zhu, D., Srinivasan, S., Sleight, H., Wagner, L. T., Matthews, M. J., Jones, E., and Sohl-Dickstein, J. (2026). AI Organizations are More Effective but Less Aligned than Individual Agents. arXiv. preprint Cited in §E.3
226. Shenoy, K., Yang, L., Sheshadri, A., Mindermann, S., Lindsey, J., Marks, S., and Wang, R. (2026). Introspection Adapters: Training LLMs to Report Their Learned Behaviors. arXiv. preprint Cited in §E.3
227. Sheshadri, A., Hughes, J., Michael, J., Mallen, A., Jose, A., Janus, and Roger, F. (2025). Why Do Some Language Models Fake Alignment While Others Don't? arXiv. preprint Cited in §E.3
228. Sheshadri, A., Ewart, A., Kempf, E., Fronsdal, K., Gupta, I., Schrodi, S., … Wang, R. (2026). AuditBench: Evaluating Alignment Auditing Techniques on Models with Hidden Behaviors. arXiv. preprint Cited in §E.3
229. Shilov, I., Cloud, A., Gema, A. P., Goldman-Wetzler, J., Panickssery, N., Sleight, H., Jones, E., and Anil, C. (2025). Beyond Data Filtering: Knowledge Localization for Capability Removal in LLMs. arXiv. preprint Cited in §E.3
230. Slocum, S., Minder, J., Dumas, C., Sleight, H., Greenblatt, R., Marks, S., and Wang, R. (2025). Believe It or Not: How Deeply do LLMs Believe Implanted Facts? arXiv. preprint Cited in §E.3
231. Sodhi, P., Li, Y., Landon, J., Wallace, E., and Chen, K. (2026). Interpreting Black Box Reward Models. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
232. Sofroniew, N., Kauvar, I., Saunders, W., Chen, R., Henighan, T., Hydrie, S., … Lindsey, J. (2026). Emotion Concepts and their Function in a Large Language Model. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
233. Souly, A., Rando, J., Chapman, E., Davies, X., Hasircioglu, B., Shereen, E., … Kirk, R. (2025). Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples. arXiv. preprint Cited in §E.1
234. team, T. A. S., Marks, w. o. f. S., and Hase., P. (2025). Recommendations for Technical AI Safety Research Directions. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
235. Templeton, A., Conerly, T., Marcus, J., Lindsey, J., Bricken, T., Chen, B., … Henighan, T. (2024). Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
236. Terekhov, M., Gulcehre, C., Hebbar, V., and Benton, J. (2026). Diffuse AI Control on Fuzzy Tasks. arXiv. preprint Cited in §E.3
237. The Safeguards Research Team (2025). Introducing Anthropic's Safeguards Research Team. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
238. Trębacz, M., Arnesen, S., Cassirer, A., Johnson, M., Lin, X., and Sottiaux, T. (2025). A Practical Approach to Verifying Code at Scale. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
239. Trębacz, M., Arnesen, S., Matthews, O., Hurd, D., Park, W., Lin, O., and Gershenson, J. (2026). Auto-review of agent actions without synchronous human oversight. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
240. Turner, N. L., Wu, J., and Batson, J. (2026). Characterizing interference weights in a tiny language model. Transformer Circuits Thread. non-peer-reviewed Cited in §E.4
241. Wagner, M., Roger, F., Cunningham, H., Gasteiger, J., Benton, J., and Mikulik, V. (2025). Training fails to elicit subtle reasoning in current language models. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
242. Wallace, E., Choquette-Choo, C. A., Kandpal, N., Toyer, S., Hunn, D., Lin, S., … Chen, K. (2026). GPT-Red: Automated Red Teaming via Self-Play at Scale. arXiv. preprint Cited in §E.5
243. Ward, J., Hu, S., Wong, A., Hu, N., Woodworth, B., Turner, A. M., and Cloud, A. (2026). Gradient Routing Localizes and Removes Unintended Behaviors in RL. arXiv. preprint Cited in §E.3
244. Wichers, N., Ebtekar, A., Azarbal, A., Gillioz, V., Ye, C., Ryd, E., … Marks, S. (2025). Inoculation Prompting: Instructing LLMs to misbehave at train-time improves test-time alignment. arXiv. preprint Cited in §E.3
245. Williams, M., Raymond, C., and Carroll, M. (2025). Sidestepping Evaluation Awareness and Anticipating Misalignment with Production Evaluations. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
246. Witten, Z., and Benton, J. (2025). Won't vs. Can't: Sandbagging-like Behavior from Claude Models. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3
247. Xu, X., Nitishinskaya, J., Schoen, B., Mossing, D., and la Tour, T. D. (2026). Studying metagaming latents in language models. OpenAI Alignment Research Blog. non-peer-reviewed Cited in §E.5
248. Yueh-Han, C., McCarthy, R., Lee, B. W., He, H., Kivlichan, I., Baker, B., Carroll, M., and Korbak, T. (2026). Reasoning Models Struggle to Control their Chains of Thought. arXiv. preprint Cited in §E.5
249. Zhang, J., Sleight, H., Peng, A., Schulman, J., and Durmus, E. (2025c). Stress-Testing Model Specs Reveals Character Differences among Language Models. arXiv. preprint Cited in §E.3
250. Zhang, J., Sleight, H., and Benton, J. (2026a). A3: An Automated Alignment Agent for Safety Finetuning. Anthropic Alignment Science Blog. non-peer-reviewed Cited in §E.3